Chapter 6. Configuring a shared VPC for Red Hat OpenShift Service on AWS clusters

Procedure

1. Create or modify a VPC to your specifications in the VPC section of the AWS console. Ensure you have selected the correct region.

2. Create the Route 53 role.

   Note

   You must create the Route 53 role in the same account where you plan to create the Amazon Route 53 hosted zones (which are created in Step 3). For example, if you want to create the hosted zones in the centrally-managed VPC account, you must create the Route 53 role in the VPC Owner account. If you want to create the hosted zones in the workload account, you must create the Route 53 role in the Cluster Creator account.

   1. Create a custom trust policy file that grants permission to assume roles:

      $ cat <<EOF > /tmp/route53-role.json
      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": "arn:aws:iam::<Account-ID>:root"
                  },
                  "Action": "sts:AssumeRole"
              }
          ]
      }
      EOF

      The trust policy principals (Principal.AWS) may be scoped down to the ingress Operator role and installer account role rather than root.

   2. Create the IAM role for the AWS managed policy ROSASharedVPCRoute53Policy.

      $ aws iam create-role --role-name <role_name> \
          --assume-role-policy-document file:///tmp/route53-role.json

   3. Attach the AWS managed policy ROSASharedVPCRoute53Policy to allow for necessary shared VPC permissions.

      $ aws iam attach-role-policy --role-name <role_name> \
      --policy-arn arn:aws:iam::aws:policy/ROSASharedVPCRoute53Policy

3. Create the VPC endpoint role.

   1. Create a custom trust policy file that grants permission to assume roles:

      $ cat <<EOF > /tmp/shared-vpc-role.json
      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Principal": {
                      "AWS": "arn:aws:iam::<Account-ID>:root"
                  },
                  "Action": "sts:AssumeRole"
              }
          ]
      }
      EOF

      The trust policy principals (Principal.AWS) may be scoped down to the ingress Operator role and installer account role rather than root.

   2. Create the IAM role for the AWS managed policy ROSASharedVPCEndpointPolicy:

      $ aws iam create-role --role-name <role_name> \
          --assume-role-policy-document file:///tmp/vpce-role.json

   3. Attach the AWS managed policy ROSASharedVPCEndpointPolicy to allow for necessary shared VPC permissions.

      $ aws iam attach-role-policy --role-name <role_name> \
      --policy-arn arn:aws:iam::aws:policy/ROSASharedVPCEndpointPolicy

4. Provide the Route 53 role ARN and the VPC endpoint role ARN to the Cluster Creator to continue configuration.

Procedure

1. Reserve an openshiftapps.com DNS domain with the following command:

   $ rosa create dns-domain --hosted-cp

   The command creates a reserved openshiftapps.com DNS domain.

   I: DNS domain '14eo.p3.openshiftapps.com' has been created.
   I: To view all DNS domains, run 'rosa list dns-domains'

2. Create an OIDC configuration.

   Review this article for more information on the OIDC configuration process. The following command produces the OIDC configuration ID that you need:

   $ rosa create oidc-config

   You receive confirmation that the command created an OIDC configuration:

   I: To create Operator Roles for this OIDC Configuration, run the following command and remember to replace <user-defined> with a prefix of your choice:
   	rosa create operator-roles --prefix <user-defined> --oidc-config-id 25tu67hq45rto1am3slpf5lq6jargg

3. Create the account roles by entering the following command:

   $ rosa create account-roles \
       --route53-role-arn <Created_Route_53_Role_Arn> \
       --vpc-endpoint-role-arn <Created_VPC_Endpoint_Role_Arn> \
       --prefix <user_defined_account_role_prefix> \
       --hosted-cp

   where:

   <Created_Route_53_Role_Arn>

   Provide the ARN for the Route 53 role that the VPC Owner created.

   <Created_VPC_Endpoint_Role_Arn>

   Provide the ARN for the VPC endpoint role that the VPC Owner created.

   <user_defined_account_role_prefix>

   Provide a prefix for the Operator roles.

4. Create the Operator roles by entering the following command:

   $ rosa create operator-roles --oidc-config-id <oidc-config-ID> \
       --installer-role-arn <Installer_Role> \
       --route53-role-arn <Created_Route_53_Role_Arn> \
       --vpc-endpoint-role-arn <Created_VPC_Endpoint_Role_Arn> \
       --prefix <operator-prefix> \
       --hosted-cp

   where:

   <oidc-config-ID>

   Provide the OIDC configuration ID that you created in the previous step.

   <Installer_Role>

   Provide your installer ARN that was created as part of the rosa create account-roles process.

   <Created_Route_53_Role_Arn>

   Provide the ARN for the Route 53 role that the VPC Owner created.

   <Created_VPC_Endpoint_Role_Arn>

   Provide the ARN for the VPC endpoint role that the VPC Owner created.

   <operator-prefix>

   Provide a prefix for the Operator roles.

   Note

   The Installer account role and the shared VPC roles must have a one-to-one relationship. If you want to create multiple shared VPC roles, you should create one set of account roles per shared VPC role.

5. After creating the Operator roles, share the Ingress Operator Cloud Credentials, Installer, and Control plane Operator Cloud Credentials role ARNs with the VPC Owner.

   The shared information resembles these examples:

   • my-rosa-cluster.14eo.p1.openshiftapps.com
   • arn:aws:iam::111122223333:role/ManagedOpenShift-Installer-Role
   • arn:aws:iam::111122223333:role/my-rosa-cluster-openshift-ingress-operator-cloud-credentials
   • arn:aws:iam::111122223333:role/my-rosa-cluster-control-plane-operator

Procedure

1. In the Resource Access Manager of the AWS console, create a resource share that shares the previously created VPC’s public and private subnets with the Cluster Creator’s AWS account ID.

2. Update the Route 53 role and add the Installer and Ingress Operator Cloud Credentials roles to the principal section of the trust policy.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
   	  "Sid": "Statement1",
   	  "Effect": "Allow",
   	  "Principal": {
   	  	"AWS": [
             "arn:aws:iam::<Cluster-Creator's-AWS-Account-ID>:role/<prefix>-ingress-operator-cloud-credentials",
             "arn:aws:iam::<Cluster-Creator's-AWS-Account-ID>:role/<prefix>-hcp-Installer-Role",
             "arn:aws:iam::<Cluster-Creator's-AWS-Account-ID>:role/<prefix>-control-plane-operator"
           ]
   	  },
   	  "Action": "sts:AssumeRole"
   	}
     ]
   }

3. Update the VPC endpoint role and add the Installer and Ingress Operator Cloud Credentials roles to the principal section of the trust policy.

   {
     "Version": "2012-10-17",
     "Statement": [
       {
   	  "Sid": "Statement1",
   	  "Effect": "Allow",
   	  "Principal": {
   	  	"AWS": [
             "arn:aws:iam::<Cluster-Creator's-AWS-Account-ID>:role/<prefix>-hcp-Installer-Role",
             "arn:aws:iam::<Cluster-Creator's-AWS-Account-ID>:role/<prefix>-control-plane-operator"
           ]
   	  },
   	  "Action": "sts:AssumeRole"
   	}
     ]
   }

4. Create a private hosted zone in the Route 53 section of the AWS console. In the hosted zone configuration, the domain name is rosa.<cluster-name>.<base-domain>. The private hosted zone must be associated with the network owner’s VPC.
5. Create a local hosted zone in the Route 53 section of the AWS console. In the hosted zone configuration, the domain name is <cluster-name>.hypershift.local. The local hosted zone must be associated with the network owner’s VPC.

6. After the hosted zones are created and associated with the network owner’s VPC, provide the following to the Cluster Creator to continue configuration:

   • Hosted zone IDs
   • AWS region
   • Subnet IDs